cloud.piranha.microprofile.omnifaces:piranha-microprofile-omnifaces-jwt (20.4.0), cloud.piranha.microprofile.smallrye:piranha-microprofile-smallrye-health (20.4.0) +806 more potentially affected by CVE-2020-1729 via io.smallrye.config:smallrye-config (>=1.5.0, <=1.6.1)

io.smallrye.config:smallrye-config MAVEN version =1.5.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.1.2 - com.cloudimpl:rest-api 2.1.0.9 and more Source cves: CVE-2020-1729 Source advisory: GHSA-54FX-GM74-Q676...

GHSA-54FX-GM74-Q676 Permissions bypass in SmallRye

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

cloud.piranha.microprofile.omnifaces:piranha-microprofile-omnifaces-jwt (20.4.0), cloud.piranha.microprofile.smallrye:piranha-microprofile-smallrye-health (20.4.0) +806 more potentially affected by CVE-2020-1729 via io.smallrye.config:smallrye-config (>=1.5.0, <=1.6.1)

io.smallrye.config:smallrye-config MAVEN version =1.5.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.1.2 - com.cloudimpl:rest-api 2.1.0.9 and more Source cves: CVE-2020-1729 Source advisory: OSV:GHSA-54FX-GM74-Q676...

Permissions bypass in SmallRye

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

io.quarkus:quarkus-smallrye-openapi-deployment (1.9.0.cr1), io.quarkus:quarkus-swagger-ui-deployment (1.9.0.cr1) potentially affected by CVE-2018-25031 via org.webjars:swagger-ui (3.35.0)

org.webjars:swagger-ui MAVEN version 3.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:swagger-ui and may be impacted: - io.quarkus:quarkus-smallrye-openapi-deployment 1.9.0.cr1 - io.quarkus:quarkus-swagger-ui-deployment 1.9.0.cr1 Sour...

CVE-2021-3914

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks...

CVE-2020-1729

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

CVE-2020-1729

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

Code injection

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

cloud.piranha.microprofile.omnifaces:piranha-microprofile-omnifaces-jwt (20.4.0), cloud.piranha.microprofile.smallrye:piranha-microprofile-smallrye-health (20.4.0) +806 more potentially affected by CVE-2020-1729 via io.smallrye.config:smallrye-config (>=1.5.0, <=1.6.1)

io.smallrye.config:smallrye-config MAVEN version =1.5.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.1.2 - com.cloudimpl:rest-api 2.1.0.9 and more Source cves: CVE-2020-1729 Source advisory: MEND:CVE-2020-1729...

CVE-2020-1729

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

CVE-2020-1729

CVE-2020-1729 affects SmallRye's API up to version 1.6.1. The vulnerability allows code running inside the application server to bypass permissions and obtain the ClassLoader, impacting data confidentiality. Root cause: improper permission checks in the API. A fix is available in SmallRye 1.6.2. ...

CVE-2020-1729

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

CVE-2020-1729: Incorrect Authorization

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

PT-2021-10084

Name of the Vulnerable Software and Affected Versions: SmallRye versions prior to 1.6.2 Description: A flaw in the API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied, posing a threat ...

com.github.oscerd:camel-cassandra (2.23.0), com.playtika.sleuth:sleuth-camel-core (1.0.2) +664 more potentially affected by CVE-2020-11971 via org.apache.camel:camel-core (2.23.0)

org.apache.camel:camel-core MAVEN version 2.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-core and may be impacted: - com.github.oscerd:camel-cassandra 2.23.0 - com.playtika.sleuth:sleuth-camel-core 1.0.2 -...

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...